topic Re: Subsearch timeout SPL in Splunk Search

Subsearch timeout SPL

mwdbhyat — Tue, 09 Oct 2018 12:28:18 GMT

Hi guys,

I have a search with subsearch that times out before it can complete. The subsearch doesnt finalise, so then then main search gets no results. Can anyone think of a better way to write this search so that perhaps that subsearch will perform better and I will not have to increase limits.conf? Are there any issues with increasing limits.conf?

index=bla [search index=bla(subject="Test*")|dedup x | table x]
|stats values(*) As * by x,filter_instance
|table _time,from,ip,recipient,subject,x

Thanks!

Re: Subsearch timeout SPL

kmaron — Tue, 09 Oct 2018 20:10:54 GMT

I think you may have simplified your example a little too much or maybe I'm just not following.

You're looking for the values of x that only exist when subject="Test*" but then you want to do a stats by x? I'm not seeing the purpose of the subsearch. Could you try either explaining it or maybe simplify it better?

Re: Subsearch timeout SPL

DalJeanis — Wed, 10 Oct 2018 14:03:42 GMT

Try this for your subsearch...

 [search index=bla (subject="Test*") x=* | stats first(index) by x | fields - index]

stats first(blah) should require less resources than dedup.

Re: Subsearch timeout SPL

woodcock — Fri, 12 Oct 2018 01:07:31 GMT

Try setting a shorter static timerange that overrides the TimePicker for the subsearch like this:

 index=bla [search index=bla(subject="Test*") earliest=-1h | stats first(host) BY x | table x ]
 |stats values(*) As * by x,filter_instance
 |table _time,from,ip,recipient,subject,x

Re: Subsearch timeout SPL

mwdbhyat — Fri, 12 Oct 2018 06:25:00 GMT

Thanks this worked